Posted
by
timothyon Thursday May 10, 2012 @12:57PM
from the for-your-own-good dept.

wiredmikey writes "Just released, and coming in at 370 MB in size, the Mac OS X 10.7.4 update includes general OS fixes, and addresses more than 30 security vulnerabilities. But aside from typical security fixes, Apple has made an interesting move in an effort to protect users. Through this latest software update, Safari 5.1.7 will now automatically disable older — and typically more vulnerable — versions of the Adobe Flash player. While many software vendors would prefer OS makers to keep their hands off their software, the move appears to be welcomed by Adobe, which has constantly battled vulnerabilities in its widely installed Flash Player."

Yeah..... remember when OS updates over your dialup line only took a few minutes? And fifteen and ten years ago the average webpage was a mere 40KB and 90KB respectively. But now it's balloned to 800KB.

I upgraded to DSL for that reason. Of course a 370MB update still requires almost an hour and a half. Couldn't they at least *try* to keep software small? I like Microsoft's new philosophy of keeping Windows8 equal to Windows7 in size (only 1/2GB RAM needed).

Imagine if MS had done this, the bitching here would be enormous. Just like how Palladium was decried by everyone when it was proposed by MS to secure PCs, but when Apple did it with iOS with extreme lockdown DRM, it was the best thing ever and there was not a peep from the same commentators that blasted MS.

I personally wouldn't have bitched one bit if MS took a stand against Flash. In fact, I would applaud them.

Apple releases an update that disables third party software, less than a month after their inability to put a dent into bd.Flashback.And yet you still shovel on the praise and manage to spin it in your own mind, that rather than it being the heavy-handed tactics of a company that has no idea how to play well with others, they are simply taking a brave stand against flash!

Apple releases an update that disables third party software, less than a month after their inability to put a dent into bd.Flashback.

They disabled Flash in Safari only. If they take drastic actions they are vilified, but if they don't do anything they are vilified as well. The new Flash updater on Windows will perform automatic & silent updates. They don't offer this as an option for OS X.

I go through a reasonable amount of effort to ensure my software was up to date. I've gotten so used to Flash updating automatically on Windows that it didn't even occur to me it wasn't doing that on my Mac. After I updated to 10.7.4, it told me Flash was out of date. So I'm going to have to say this is a good move. I'd imagine most Mac users have outdated Flash versions.

If you own a commercial Adobe product, it comes with an update manager that can auto-update Flash. I don't know why they didn't provide this for their stand-alone free product.......but every time the automatic update software kicks in, I end up double checking to verify that it's the REAL automatic update software, as this is an obvious thing for a drive-by download to spoof.

If your definition of "automatic" is several dozen popups and mouse clicks, reading and accepting a new license agreement, etc. every single damn time you switch on a PC then, yes, I guess it's automatic.

Do they ASK the user before they do it? If yes then I'm all for it and if not then the guy that got labeled a troll got a bum rap. Remember folks that BOTH Apple and MSFT are pushing for an app store model that will give them unprecedented control, so if one doesn't draw lines in the sand now frankly you may not get a chance to later.

Ultimately it should be the USER that gets to decide what stays and goes and lets be honest, we are talking about a single pop up with an explanation and a yes/no box, reall

Not if you give them a means to install it. As would appear to be the case based on the number of malware infections that people have willingly installed as well as all the crapware that gets put on machines, put a button that says "download" or "install" in front of them and they will do it. Which is exactly what Apple did.

I think a notification/warning would be nice prior to purging it from the system. Maybe it does, I don't know.

On both of the systems I applied it to yesterday, it popped up a dialog warning me that it was going to disable the out-of-date flash player, and inviting me to visit Adobe's website to download the latest copy. The two buttons on the dialog were along the lines of one to go to the download page, and one to simply continue disabling the out-of-date plug-in.

I think a notification/warning would be nice prior to purging it from the system. Maybe it does, I don't know. But at least let the owner of the computer know that...

Agreed. Nothing is more annoying than a piece of software turned off because "we know better". Follows what sort of dialog I would myself craft..;)

"MacOS has detected an old version of Adobe Flash running on your computer. To help protect your security, this software has been temporarily disabled. You can choose to continue running current version (not recommended) or update Flash."

>>>I think a notification/warning would be nice prior to purging it from the system.

You have no more right to be notified when Old Flash is being purged from your computer then to not be vaccinated from disease. This is a proactive measure from the state (or the megacorp acting for the state) to protect the internet from bad programs. We can't allow your diseased computer (or body) to be spreading these bots/viruses to other people.

Actually it is the same. Saying people cannot "interact with society at large" unless they are vaccinated is equivalent to forcing all computers to have the latest Updates and a virus prevention, else they won't be allowed on the internet.

It is disappointing that none of the updates to this tool have even tried to stop such a widespread infection. If anything, the enormous flash install base demonstrates that Microsoft's tool is completely ineffective against serious a malware infection.

For the last time, Apple is not microsoft and is not a convicted monopolist. Your comparison is retarded. When Apple holds ~85% share of all computers EVERYWHERE, then you can start making valid comparisons between the two.

For the last time, Apple is not microsoft and is not a convicted monopolist. Your comparison is retarded. When Apple holds ~85% share of all computers EVERYWHERE, then you can start making valid comparisons between the two.

For the last time, Apple is not microsoft and is not a convicted monopolist. Your comparison is retarded. When Apple holds ~85% share of all computers EVERYWHERE, then you can start making valid comparisons between the two.

For the last time, Apple is not microsoft and is not a convicted monopolist. Your comparison is retarded. When Apple holds ~85% share of all computers EVERYWHERE, then you can start making valid comparisons between the two.

You're right, they're only a tiny helpless corporation with more spare cash (not even something intangible like nonliquid assetsmoney, but real money) than any other company in existence right now. Stop picking on them! they obviously don't have the capability to do anything beyond what they currently are able to manage, poor guys:C

Microsoft is a convicted monopolist, because they bundled their web browser with their operating system. Therefore, if they distribute a patch or an upgrade which as part of its functionality disables a product which:

is from a third party vendor; and

is out dated and superceded; and

is known to be particularly vulnerable

and the third party vendor expresses their support for that action;

then they are scum and you disapprove. But only because they were convicted of bundling IE with Win

My argument is we treat Microsoft history with a different lens because of the egregious nature of being a convicted monopolist AND the nature of their overt acts. They tried to own all of computing and people fucking forget that. Your attempt to reduce the the verdict and punishment to browsers is cute. They convicted MS just like Al Capone, they got them for what they could get them for, even though there was a ton of other behavior that in a sane world would be punished too.
Microsoft needs to continue

They were judged to have done a bad thing, they were convicted, and they paid the price. Agreed, not a stellar part of Microsoft's corporate history. Okay. Why does that mean that if they did the same thing today as Apple is doing, with the purpose of enhancing security, and with the full approval of the involved third party, you should have a different response based on whether it's Apple or Microsoft?

Your attempt to reduce the the verdict and punishment to browsers is cute.

"Cute"? Anyway...

I recognize things are almost always more complex than they appear on the surface. But fu

"Can we stick to the point? If Microsoft were to do the exact same thing as Apple are doing in this case, would you approve or complain?"

I reject the question outright. They are not the same and shall not be judged the same. Just because you feel like they have paid their penance doesnt mean that we dont STILL feel the effects of those crimes today. What they got was a slap on the wrist because at the end of the day Windows 'worked' for everyone and the DOJ was afraid of killing the golden goose. We judg

I don't think that's true. Mainly because I think you're vastly underestimating the blood-soaked hatred most people here have for the Flash player.

I also think most people here are probably fine with the masses getting their shit updated automatically, as long as those of us who develop for and/or have to support old versions have the option of keeping older versions around when necessary.

requirements are key, I couldn't care less about how it looks. Right now I'm using a ZTE F930 tethered to my laptop for interweb access, my carry-around is a Motorola V3. Basic model, no memory card slot, vga camera but it's rugged and works everywhere. The smartphone might be pretty but that's precisely why I don't carry it - who's gonna want to steal an eight year old EDGE/GPRS handset??

These people who replaced desktop/laptops/netbooks with the iPad never really wanted a PC in the first place. The only reason they had one originally was because it was pretty much the only way to go on the internet. Most people don't want a general-purpose computer as it is just too complex to understand. They have no desire to program it, futz with the settings, or even change hardware components. I'm convinced that Apple doesn't include an SD card in their iPads because A, the slot looks ugly, and B, h

Just to add a data point, I and many other bitched widely when Apple updates would automatically reinstall and activate Flash. There was no way to get away from flash. Apple depending on it for it's advertising, so that was all there was to it. Of course such comments are moderated down as such comments are meaningful, as opposed to comments that just randomly complain how unfair the world is.

Now Apple, and the rest of the world, is not so dependent so much on Flash, due partly to the iPad, so they can

I would have exactly zero problems with Microsoft doing something like this (their biggest problem: getting people to actually install the update).

When I read the headline and started the summary my reaction was along the lines of "whaaaaaat!". Then I saw that they were only disabling "older" versions of Flash, not Flash entirely, and thought about what it would be like for the end user. They visit a website that uses Flash, they see a message that Flash is not enabled or installed with a link to install it, they go through the process, et voila, you've gotten your users to update to the latest Flash player.

I have zero issues with an OS update automatically disabling old vulnerable software versions (especially Java and Acrobat reader), provided there is a way for the user to re-enable them if there's some reason that they require a specific old version.

I also generally hate every stance that Apple takes regarding control over their products, but this decision does make sense if they're trying to protect their users who wouldn't otherwise protect themselves. Microsoft should do the same.

When I read the headline and started the summary my reaction was along the lines of "whaaaaaat!". Then I saw that they were only disabling "older" versions of Flash, not Flash entirely, and thought about what it would be like for the end user.

Right. Disabling Flash entirely is what Microsoft is doing, in the "Metro" flavor of "Windows 8" (where no browser plugins work at all).

(Though if you flip back into "Desktop" mode, you can still get them. The "Desktop" flavor of the web browser is dumbed down over c

From a small business standpoint Mac is simply not an option in many cases. Most medical transcription software, dental software, Sage/ Planning/construction software requires Windows and often times a back-end Windows server machine. On top of that things like Google Apps sync is only for the PC, not mac, preventing Mac users from using the paid Google Apps services. If you just fart around and browse the web and send emails the built in Mac software works fine, but for those that run businesses it's a

No one is going to deploy a virtual hackintosh in a production environment. Unless the bare metal is a mac, you are in violation of the mac EULA. See Psystar v. Apple.

Why are you watching video in a virtual environment? Also, VMs are more then jsut another 'machine'. Its a machine with some very unique and useful properties above and beyond what a bare metal machine is. Running one ALL the time is not the same thing as running a bare metal machine. You can replace a Windows m

Strange that you should run OSX and Linux on Windows 7...I'd suggest doing it the other way around, making your base system Linux or OS X, and then running a lightweight VM for your medical transcription software/dental software/etc. -- a trimmed XP in a VM should do the job nicely -- assuming that you can't just use something like WINESkin [doh123.com] to run the software directly inside OS X.

The only place I've ever had problems running Win32 software natively under OS X or Linux on an Intel processor has been when th

Further to this, since I've owned my mac, i've been able to get real work done without having to purchase very many applications at all. Pixelmator, TextWrangler and with iLife and Xcode, i can create/edit multimedia content write native applications, do web development, network admnistration (ssh, and friends are included), etc.

I've had a Macbook Pro for almost two years now, and I've yet to run into a problem with lacking software variety or developer-friendliness. Most Windows software has either a straight Mac port or comparable Mac software. And under the bells and whistles and shiny paint, OS X is a Unix-based OS just like Linux is. Dig down deep enough, and you'll find that their innards are remarkably similar.

And the only big difference involving software variety is the fact that there's a whole lot less shovelware for O

No, it's clearly trolling. I imagine it's the same guy who has made an anti-Google one that started showing up yesterday. My thought is it's either someone just trolling for fun or someone creating obviously shill-like accounts to bolster their pet theory that every second person on/. is a shill paid to astroturf. Probably best to just ignore it.

If you frequent macrumors or other mac sites, you will realise that mac owners are some of the most bitchy/picky people on the planet. Apple does NOT get a free pass with their users. Their gear generally works better BECAUSE of this intolerance of existing apple users, not the other way around. Just google some of the complaints about Lion.

To be honest, I like the fact that you can get a full report in a single file, which shows the full evidence of circumstances being reported by having some of the linked citations as embedded videos etc. So, I have to disagree with you.

Safari 5.1.7 is installed AFTER upgrading the OS to 10.7.4. The ~400MB delta or ~1.3GB combo updates applied thru Software Update (700MB delta / 1.55GB combo if downloaded as standalone updaters) bring Safari to 5.1.6 and patch a slew of other pending issues. Then you can run Software Update again and install the ~35MB Safari 5.1.7 update.

As for the disabling of vulnerable versions of third-party software, worth noting that a couple of weeks back during the FlashBack Trojan affaire, after installing the sec

This is an issue that all non-OS applications have: how to get and install updates in a timely manner? Firefox checks for updates upon launch; drawback: annoyance for user as this results in an apparent slow launch. Google installs an update service; drawback: many users will disable this service due to the perception that it could slow down the entire system. Adobe Flash Player is a "system plugin" with its own update tool that runs at boot time; drawback: it requires user interaction, thus it is annoying. RealPlayer creates update tasks in the TaskManager; drawback: some users will disable them as they could increase boot/login time and/or are perceived as intrusive/spyware. The only acceptable solution is a system-wide update system, the way it works on Linux but without any user interaction; or updates delivered for all installed applications via Windows Update on Windows (which Microsoft is unlikely to accept).

The only acceptable solution is a system-wide update system, the way it works on Linux but without any user interaction; or updates delivered for all installed applications via Windows Update on Windows (which Microsoft is unlikely to accept).

As long as it is optional. I see no reason to force user to upgrade anything on their system. Also, the OS could simply have a tool that programs can register with at install. That one tool would then regularly check for all registered programs. It doesn't have to be a single repository of software just a single communication standard.

This is an issue that all non-OS applications have: how to get and install updates in a timely manner? Firefox checks for updates upon launch; drawback: annoyance for user as this results in an apparent slow launch. Google installs an update service; drawback: many users will disable this service due to the perception that it could slow down the entire system. Adobe Flash Player is a "system plugin" with its own update tool that runs at boot time; drawback: it requires user interaction, thus it is annoying. RealPlayer creates update tasks in the TaskManager; drawback: some users will disable them as they could increase boot/login time and/or are perceived as intrusive/spyware. The only acceptable solution is a system-wide update system, the way it works on Linux but without any user interaction; or updates delivered for all installed applications via Windows Update on Windows (which Microsoft is unlikely to accept).

The difficulty with some of these (granted, never had this issue with flash) is legacy support. Some businesses run specialized software that is occasionally broken by software updates. My personal experience with this has been JRE updates that break an app, until a couple release down the line fixes the issue, but others have seen this with Firefox as well. When this happens, users begin to equate "updates" with "broken apps" and then puts them off, it not avoiding them forever. While this isn't an excuse,

Most GNU/Linux and BSD derivates do this.MS doesn't because they don't want people to use IE, WMP, MS Office, etc. As long as they dont' provide the means for third parties to install/update software, they can control what average joe installs/runs. And it contributes to keep third party software out-of-date, which makes the software look bad as well, hence, point for MS (from the average user's PoV).

I understand not offering support or having a important sounding warning but why make it mandatory? I tend to keep my software updated but what if I didn't want to update my software? Why should Apple or any company be able to come in and make changes to my system without me first either giving them permission or setting the computer/software to auto-update?

What Adobe needs to do is completely overhaul Flash. And by overhaul, I mean throw it away and create a brand new Flash player from scratch that fulfills the specifications. And if the specifications lead to security holes, then change the specifications. But Adobe is either unable to do this, or too scared to do it.

Isn't this more or less what Apple is attempting to do, except they call the overhauled version "HTML 5"?

Why *should* they leave your computer alone? If you are either too stupid or unwilling to take proper care of it, and the repercussions of that fact affect everyone around you, then don't start complaining when others take the job out of your hands.

There are all sorts of regulations regarding cars. You need licenses, tests to prove you can drive safely, legally mandated regular checkups, etc. If you don't follow through, then the gov't will decide you can't drive it anymore.

It's inevitable that the same will happen to computers, for pretty much the exact same reasons.

TL;DR version: If you want people to treat you like an adult, then ACT like one.

I've always viewed Apple hardware as the toaster oven of computers. In that, I don't *care* what's going on under the hood, I just want the bloody thing to work - which it does, barring spouses leaving it switched on and resting on a feather pillow (ouch time!). When I want something to tinker with, I crank up my Linux box and if I really have a few hours to kill, on goes the Wintendo.

Because if you are stupid enough to run ancient versions of plugins like adobe flash and not bothered to update, then your ability to manage your computer is so poor that you don't deserve the privilege making that choice.

Software will always have bugs, and until there is a seismic shift in attitude over how software is designed, security vulnerabilities will always exist. The question becomes a) how do the vendors respond, and b) how do the users respond. Vendors should be putting out updates to patch th

Since you appear to be fond of the hyperbolic, lets try this: You buy a gun. Are you allowed to buy a guy? Yes. Are you allowed to wave it around in the privacy of your own home? Yes. Are you allowed to wave it at someone else? No, unless you have a license.

Now take that same gun, put it on a pedestal in front of you, and stand back as hundreds of thousands of people walk past it, some of them looking at it, some of them poking at it... and a couple attach a doohi

Now I see why you're posting as a coward. I admit I was curious to see how this would play out, but now that I know I can just save myself the time and effort of responding to anonymous cowards in the future.

Consider this almost a year... people were saying this when the App Store came out, and it's not true yet....

A more realistic timeline would be ten years, at which point you'll likely need to register with Apple and sign the developer's keychain to install software on whatever the OS X replacement is. Before a step like this happens (with a new OS), I don't see running arbitrary code going anywhere.